Data Processing Agreement (DPA)

Data Processing Agreement

pursuant to Art. 28 GDPR · As of: 2026-05-25

This English translation is provided for your convenience. Only the German version is legally binding.

This Data Processing Agreement (DPA) is concluded automatically upon your registration with PushPig between you as the controller and Heiko Stuhrmann as the processor and applies for the duration of your use of the service. A separate signature is not required. Should you require an additional, individually signed version, you can contact us via the contact form.

Parties

The controller within the meaning of this agreement is the user (natural or legal person) registered with PushPig. Identification is carried out on the basis of the master data stored in the PushPig account (username, email address, and, where applicable, billing data under the Pro plan).

Processor:

Heiko Stuhrmann
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach, Deutschland
E-Mail: webmaster@pushpig.de

§ 1 Subject matter and term

The subject matter of this agreement is the processing of personal data by the processor for the provision of the PushPig service, in particular for the storage, transmission and delivery of push notifications on behalf of the controller.
The agreement commences upon the controller's registration with PushPig and applies for the duration of the principal service relationship. It terminates automatically upon deletion of the PushPig account.
Processing is carried out exclusively on documented instructions from the controller, unless the processor is required to process the data by Union law or the law of a Member State. Instructions are generally issued through actions in the PushPig customer area (creating/deleting channels, dispatch orders, account deletion) and may be specified in more detail by written supplements (email is sufficient).

§ 2 Nature and purpose of the processing

Nature of the processing: Collection, storage, structuring, transmission, retrieval, use, restriction, deletion or destruction of personal data in connection with the delivery of push notifications and user administration.
Purpose: Provision of the PushPig service, i. e. delivery of push messages to Android devices (Firebase Cloud Messaging), browsers (Web Push), by email or webhooks; management of channels, subscribers, templates, bulk dispatch jobs and API keys.

§ 3 Types of personal data

The processing may concern, in particular, the following categories of data:

Master data (username, email address, password hash, avatar)
Communication data (push content: title, text, optional payload data)
Device and token data (FCM token, Web Push endpoint, p256dh/auth)
Recipient lists for CSV bulk dispatch (username plus per-recipient variables)
Usage data (timestamps of dispatches, IP address, user agent in logs)
Webhook payloads, insofar as they relate to personal data
2FA data (TOTP secret, registered passkeys)

§ 4 Categories of data subjects

Users (customers) of the controller, insofar as they are contacted via PushPig
Employees of the controller who use the service
Other recipients of push messages and emails initiated by the controller

§ 5 Obligations of the processor

The processor processes personal data exclusively within the scope of this agreement and in accordance with the documented instructions of the controller, unless it is legally required to process the data otherwise (in which case it shall inform the controller of that legal requirement before processing, unless the law prohibits such information).
The processor ensures that the persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Taking into account the nature of the processing and the information available to it, the processor assists the controller in ensuring compliance with the obligations set out in Articles 32 to 36 GDPR.
Personal data is processed exclusively within the EU/EEA, with the exception of the sub-processors listed in Annex 2, for which an adequate level of data protection (Art. 46 GDPR, EU-US Data Privacy Framework, Standard Contractual Clauses) is ensured.

§ 6 Technical and organisational measures (TOMs)

The processor implements the technical and organisational measures described in Annex 1 in accordance with Art. 32 GDPR and warrants compliance with them throughout the term of the contract. Changes that do not reduce the level of security are permitted.

§ 7 Rectification, restriction and deletion of data

The processor may only rectify, delete or restrict the processing of personal data on the instructions of the controller.
The processor forwards requests from data subjects to the controller without undue delay and does not respond to them on its own initiative.

§ 8 Sub-processing relationships

By registering, the controller grants general written authorisation for the engagement of the sub-processors listed in Annex 2.
The processor will notify the controller of any intended changes (addition or replacement of sub-processors) with reasonable notice (at least 30 days) in advance, via the email address stored in the account or by publishing a new version of this DPA (with a clear notice within the service). The controller has a right to object on important grounds. In the event of a legitimate objection, the parties are entitled to extraordinary termination of the principal service contract.
The processor ensures, by means of corresponding contractual provisions, that the obligations under this agreement are imposed on the sub-processors.

§ 9 Controller's audit rights

The controller has the right to monitor the processor's compliance with this agreement. Monitoring is generally carried out by requesting a self-disclosure or the submission of a current audit report from an independent expert (e. g. an ISO 27001 certificate of a sub-processor).
On-site inspections are permitted only in justified exceptional cases and after coordination with reasonable advance notice (at least 4 weeks). The processor may charge for the associated effort at customary rates.

§ 10 Notification of breaches

The processor notifies the controller of any personal data breach without undue delay, and in any event no later than 72 hours after becoming aware of it, providing the information required under Art. 33(3) GDPR. Notification is sent to the email address stored in the account.

§ 11 Controller's power to issue instructions

Instructions are issued through actions in the PushPig customer area (e. g. creating/deleting channels, dispatch orders, account deletion) as well as through supplementary written instructions (email is sufficient).
If the processor is of the opinion that an instruction infringes data protection provisions, it must inform the controller of this without undue delay and is entitled to suspend execution until the instruction is confirmed or amended.

§ 12 Deletion and return after the end of processing

Upon termination of the principal service relationship (account deletion), the processor deletes all personal data of the controller, unless statutory retention obligations preclude this.
The standard deletion periods are documented in the privacy policy. Upon account deletion, master and push subscription data are removed without undue delay; backups are overwritten within 30 days.
The controller can export its data independently via the account functions or request it by email before deletion.

§ 13 Liability

Art. 82 GDPR applies. The parties are liable to data subjects in accordance with the provisions set out therein. In their internal relationship, each party is liable for the infringements attributable to it. Any liability in the internal relationship between the parties is limited to gross negligence and intent, unless mandatory statutory provisions provide otherwise.

§ 14 Amendments to this agreement

The processor is entitled to amend this DPA insofar as this is necessary due to a changed legal situation, new sub-processors or altered processing procedures. Material changes are announced to the controller with reasonable notice (at least 30 days) in advance by email or by a clearly visible notice within the service.
If the controller does not object to the changes within the period, they are deemed to be accepted. In the event of a legitimate objection, both parties are entitled to terminate the principal service contract.
The current version of this DPA is available at pushpig.de/avv.

§ 15 Miscellaneous provisions

Should the controller's ownership of or control over the data held by the processor be jeopardised by attachment, seizure, insolvency or composition proceedings, or by other events or measures of third parties, the processor must inform the controller thereof without undue delay.
German law applies. The exclusive place of jurisdiction is, to the extent legally permissible, the registered office of the processor.
Should any provision of this agreement be or become invalid, the validity of the remaining provisions shall not be affected thereby.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

1. Confidentiality (Art. 32(1)(b) GDPR)

Physical access control: Server locations are provided exclusively by certified data centre operators within the European Union. No proprietary hardware is used.
System access control: SSH access via public-key authentication, no password login. Admin accounts with mandatory 2FA.
Data access control: Role-based permissions within the application (user / admin), channel-owner separation, API keys with fine-grained scopes per channel and action.
Separation control: Strict tenant separation in the database via user_id foreign keys; physically separated databases between production and development systems.
Pseudonymisation: Passwords stored exclusively as an Argon2id hash; session IDs randomly generated (256-bit entropy).

2. Integrity (Art. 32(1)(b) GDPR)

Transfer control: All data transmission is encrypted exclusively via TLS 1.2+ (HTTPS, FCM, webhooks).
Input control: Audit logs for account events (login, logout, push dispatch, webhook calls) with IP address and timestamp; retention period max. 30 days.

3. Availability and resilience (Art. 32(1)(b) GDPR)

Availability control: Daily database backups, stored encrypted in the EU data centre, retained for 30 days.
Recoverability: Restore procedures tested regularly.
DDoS / abuse protection: Application-side rate limiting and bot protection (honeypot + timing check) on login, registration, password reset, contact form and newsletter sign-up.

4. Procedure for regular review (Art. 32(1)(d) GDPR)

Data protection management: Privacy by design in the development process, annual review of processing activities.
Incident response management: Defined reporting channel for data breaches (cf. § 10).
Processing control: Written commitment of sub-processors (see Annex 2).

Annex 2: Approved sub-processors

The following sub-processors are engaged with the controller's consent:

Provider	Location	Purpose	Data transfer mechanism
Google LLC (Firebase Cloud Messaging)	USA	Delivery of Android push notifications	EU-US Data Privacy Framework + SCC
Polar Software, Inc. (Pro plan only)	USA	Payment processing as Merchant of Record	EU-US Data Privacy Framework + SCC
Strato AG (SMTP dispatch)	Deutschland (EU)	Dispatch of verification, invitation and notification emails	EU / no third-country transfer

Updates to this list are notified to the controller in accordance with § 8 of this agreement.

Help & API · Pricing · Contact · Imprint · Privacy